Rebuttal to Sven Taylor's article on Tor?

Question

In October 2019, Sven Taylor published a sobering article titled Is Tor Trustworthy and Safe?. In it he argues that (numbering mine),

1. US government agencies can de-anonymize Tor users on a “wide scale”
2. ...proven by a 2017 case in which the FBI de-anonymized Tor users
3. Tor developers are cooperating closely with US government agencies
4. Anybody can operate Tor nodes and collect your data and IP address; there's no quality control for nodes
5. Malicious Tor nodes do exist
6. No warrant necessary to spy on Tor users
7. Tor was created and is funded by the US government
8. Tor users are targeted merely for using Tor

A few other aspects are highlighted, even though they're mentioned in the documentation (e.g. potential IP address leaks via PDFs). The solution offered by the article is to use Tor through a VPN.

Which of these claims are the most serious problems with Tor, and how can users defend against them?

Answer 1

1. Unknown. There are known techniques that can de-anonymize on a large scale (eg. running a substantial fraction of the entry and exit nodes), but it's unknown if anyone is using them.
2. Unknown. The refusal of the FBI to disclose how they de-anonymized the defendant in this case makes evaluating it impossible.
3. True, and misleading. The known cooperation is with various intelligence agencies who want secure communication channels with their agents, and with the State Department, who want secure communication tools for dissidents. They're working with Tor developers to improve security, not break it.
4. True, and meaningless. The whole point of Tor is that even if a node is operated by an attacker, they can't figure out both of (a) who you are, and (b) what you are doing.
5. True, and mostly meaningless. The major risk here is an exit node injecting content into the data stream (eg. malicious Javascript into a webpage), and the operators of the Tor directory authorities are fairly good at kicking out any nodes found to be tampering with data.
6. Very complicated. Certain types of "spying" such as de-anonymizing users does not require a warrant, but most other types do.
7. True, and misleading. It was created by the US Naval Research laboratory as a way to protect US intelligence communications over the Internet.
8. True, and misleading. In the specific case cited, the person was not "targeted for using Tor", the person was targeted for sending a bomb threat. Yes, there are countries where the mere use of Tor is grounds for being targeted, but the United States is not one of them.

The best way to defend against these claims is to ignore them. They're mostly anti-Tor scaremongering, with just a hint of truth. Your best option is to follow good operational security practices, which mostly don't involve that website's suggestion of combining Tor with a VPN.